CRITICAL🇬🇧 English

CVE-2017-3192

CVSS 9.8v3.0pub. 2017-12-16upd. 2026-05-13

D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page discloses the administrator password in base64 encoding in the returned web page. A remote attacker with access to this page (potentially through a authentication bypass such as CVE-2017-3191) may obtain administrator credentials for the device.

oryginał EN
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Dlink Dir 130

    HW
    Dlink
    wszystkie wersje

  • Dlink Dir 330

    HW
    Dlink
    wszystkie wersje

  • D Link Dir 130 Firmware

    OS
    D-Link
    1.23

  • D Link Dir 330 Firmware

    OS
    D-Link
    1.12
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Auth Bypass
CWE
Referencje

Powiązane podatności

CVE-2017-3191CRITICAL9.8ten sam produkt

D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass...

CVE-2024-3272CRITICAL9.8⚠ KEVPL ✓ten sam vendor

D-Link DNS-320L/325/327L/340L — zakodowane na stałe poświadczenia (hard-coded credentials)

CVE-2023-25280CRITICAL9.8⚠ KEVten sam vendor

OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to roo...

CVE-2016-20017CRITICAL9.8⚠ KEVten sam vendor

D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli para...

CVE-2022-37055CRITICAL9.8⚠ KEVten sam vendor

D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via...